Claims 

Please amend the claims as follows: 

1 . (Currently amended) A method comprising: 

grouping single fields of a multiple-field source into a search target having a 
plurality of multiple-field keys (MFKs) whos e, each MFK having single fields that 
correspond to [[the]] single fields in one of a plurality of multiple-field vectors (MFVs) 
of entries in a data structure; 

generating a set of queries based, at least in part, on the MFKs, wherein each 
query includes one or more of the MFKs and wherein each query has a different MFK as 
a lead MFK; 

using a query to determine whether the non-wildcard values in the MFVs of an 
entry match the non- wildcard values in corresponding MFKs of the search target; and 

using, if no entry has non-wildcard values in the MFVs that match the 
corresponding non-wildcard values in the MFKs, the queries to determine whether the 
entry has non-wildcard values in a MFV that match the non-wildcard values in a 
corresponding lead MFK, plus remaining MFVs that match corresponding remaining 
MFKs based on matching the non-wildcard values and wildcard values. 

2. (Original) The method of claim 1, wherein the entries of the data structure 
are stored such that the MFVs that have non-wildcard values are located at the end of the 
entry. 
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3. (Original) The method of claim 1, further comprising arranging the 
entries of the data structure so that the MFVs that have non-wildcard values are placed at 
the end of the entry. 

4. (Original) The method of claim 1, wherein the non- wildcard values 
comprise a fixed value and/or a range of fixed values. 

5. (Original) The method of claim 1, further comprising: 

locating the entry having non-wildcard values in the MFV that match the non-wildcard 
values in the corresponding lead MFK, plus remaining MFVs that match corresponding 
remaining MFKs based on matching the non-wildcard values and wildcard values; and 
performing an operation associated with the located entry. 

6. (Original) The method of claim 1, wherein the multiple-field source 
comprises a data packet having single fields in its header. 

7. (Original) The method of claim 6, wherein the operation comprises one of 
the following: dropping the data packet, mirroring, metering, traffic shaping, rate 
limiting, accounting, statistics gathering, providing quality of service (QoS), redirecting 
to a central processing unit (CPU) for further processing, or sampling a subset of the 
packets to a CPU. 

8. (Original) The method of claim 1, wherein fewer than all MFVs in the 
entries include one single field. 

9. (Original) The method of claim 1, wherein the MFVs in the entries 
include two or more single fields. 
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10. (Currently amended) An apparatus comprising: 

a data structure having a plurality of entries, wherein each entry has a group of 
multiple-field vectors (MFVs) that each include a number of single fields having all 
wildcard values or all non- wildcard values; and 

a search unit to group single fields of a multiple-field source into a search target 
having a plurality of multiple-field keys (MFKs) whos e, each MFK having single fields 
that correspond to the single fields in multiple field vectors (MFVs) in a corresponding 
MFV of the entries in [[a]] the data structure, generate a set of queries based, at least in 
part, on the MFKs, wherein each query includes one or more of the MFKs and has a 
different MFK as a lead MFK, use a query to determine whether the non-wildcard values 
in the MFVs of an entry match the non-wildcard values in corresponding MFKs of the 
search target; and use, if no entry has non-wildcard values in the MFVs that match the 
corresponding non-wildcard values in the MFKs, the queries to determine whether the 
entry has non-wildcard values in a MFV that match the non-wildcard values in a 
corresponding lead MFK, plus remaining MFVs that match corresponding remaining 
MFKs based on matching the non-wildcard values and wildcard values.. 

1 1 . (Original) The apparatus of claim 10, wherein the entries of the data 
structure are stored such that the MFVs that have non-wildcard values are located at the 
end of the entry. 

12. (Original) The apparatus of claim 10, wherein the search unit arranges the 
entries of the data structure so that the MFVs that have non-wildcard values are placed at 
the end of the entry. 
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13. (Original) The apparatus of claim 10, wherein the non- wildcard values 
comprise a fixed value and/or a range of fixed values. 

14. (Original) The apparatus of claim 10, wherein the search unit locates the 
entry having non- wildcard values in the MFV that match the non-wildcard values in the 
corresponding lead MFK, plus remaining MFVs that match corresponding remaining 
MFKs based on matching the non-wildcard values and wildcard values; and performs an 
operation associated with the located entry; 

15. (Original) The apparatus of claim 10, wherein the multiple-field source 
comprises a data packet having single fields in its header. 

16. (Original) The apparatus of claim 15, wherein the operation comprises 
one of the following: dropping the data packet, mirroring, metering, traffic shaping, rate 
limiting, accounting, statistics gathering, providing quality of service (QoS), redirecting 
to a central processing unit (CPU) for further processing, or sampling a subset of the 
packets to a CPU. 

17. (Original) The apparatus of claim 10, wherein fewer than all MFVs in the 
entries include one single field. 

18. (Original) The apparatus of claim 10, wherein the MFVs in the entries 
include two or more single fields. 

19. (Currently amended) An article of manufacture comprising: 

a machine-accessible medium including thereon sequences of instructions that, 
when executed, cause an electronic system to: 
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group single fields of a multiple-field source into a search target having 
multiple-field keys (MFKs) whose , each MFK having single fields that correspond to 
[[the]] single fields in one of a plurality of multiple-field vectors (MFVs) of entries in a 
data structure; 

generate a set of queries based, at least in part, on the MFKs, wherein each query 
includes one or more of the plurality of MFKs and wherein each query has a different 
MFK as a lead MFK; 

use a query to determine whether the non-wildcard values in the MFVs of an 
entry match the non- wildcard values in corresponding MFKs of the search target; and 

use, if no entry has non-wildcard values in the MFVs that match the 
corresponding non-wildcard values in the MFKs, the queries to determine whether the 
entry has non-wildcard values in a MFV that match the non-wildcard values in a 
corresponding lead MFK, plus remaining MFVs that match corresponding remaining 
MFKs based on matching the non-wildcard values and wildcard values. 

20. (Original) The article of manufacture of claim 19, wherein the entries of 
the data structure are stored such that the MFVs that have non-wildcard values are 
located at the end of the entry. 

21 . (Original) The article of manufacture of claim 19, wherein the 
machine-accessible medium further comprises sequences of instructions that, when 
executed, cause the electronic system to arrange the entries of the data structure so that 
the MFVs that have non- wildcard values are placed at the end of the entry. 
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22. (Currently amended) The method article of manufacture of claim 19, 
wherein the non-wildcard values comprise a fixed value and/or a range of fixed values. 

23. (Original) The article of manufacture of claim 19, wherein the 
machine-accessible medium further comprises sequences of instructions that, when 
executed, cause the electronic system to: 

locate the entry having non- wildcard values in the MFV that match the 
non- wildcard values in the corresponding lead MFK, plus remaining MFVs that match 
corresponding remaining MFKs based on matching the non-wildcard values and wildcard 
values; and 

perform an operation associated with the located entry. 

24. (Original) The article of manufacture of claim 19, wherein the 
multiple-field source comprises a data packet having single fields in its header. 

25. (Original) The article of manufacture of claim 24, wherein the operation 
comprises one of the following: dropping the data packet, mirroring, metering, traffic 
shaping, rate limiting, accounting, statistics gathering, providing quality of service (QoS), 
redirecting to a central processing unit (CPU) for further processing, or sampling a subset 
of the packets to a CPU. 

26. (Original) The article of manufacture of claim 19, wherein fewer than all 
MFVs in the entries include one single field. 

27. (Original) The article of manufacture of claim 24, wherein the MFVs in 
the entries include two or more single fields. 
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28. (Currently amended) A system, comprising: 
a processor; 

a network interface coupled with the processor; and 

an article of manufacture comprising a machine-accessible medium including 
thereon sequences of instructions that, when executed, cause an electronic system to: 

group single fields of a multiple-field source into a search target having a plurality 
of multiple-field keys (MFKs) whose , each MFK having single fields that correspond to 
the single fields in one of a plurality of multiple-field vectors (MFVs) of entries in a data 
structure; 

generate a set of queries based, at least in part, on the MFKs, wherein each query 
includes one or more of the plurality of MFKs and has a different MFK as a lead MFK; 

use a query to determine whether the non-wildcard values in the MFVs of an 
entry match the non- wildcard values in corresponding MFKs of the search target; and 

use, if no entry has non-wildcard values in the MFVs that match the 
corresponding non-wildcard values in the MFKs, the queries to determine whether the 
entry has non-wildcard values in a MFV that match the non-wildcard values in a 
corresponding lead MFK, plus remaining MFVs that match corresponding remaining 
MFKs based on matching the non-wildcard values and wildcard values. 

29. (Currently amended) The method system of claim 28, wherein the 
non- wildcard values comprise a fixed value and/or a range of fixed values. 

30. (Currently amended) The article of manufacture system of claim 28, 
wherein the multiple-field source comprises a data packet having single fields in its 



header. 
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